Back to skill

Security audit

Error Message Improver

Security checks for vulnerabilities and agentic risk

Overview

This skill provides ordinary guidance for improving error messages, with overly broad activation terms but no material security concern.

Use it for error-message improvement and review any generated code changes. Its broad keywords may also activate it during unrelated support or productivity requests.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Activation criteria include broad productivity and support requests unrelated to improving error messages.

Medium
Category
Trigger Abuse
Confidence
98% confidence
Finding

The description activates the skill for work-productivity, debugging, user feedback, or support, and the keyword list at L44 reinforces these broad triggers. These terms cover many tasks unrelated to rewriting error messages, with no explicit exclusions or requirement that the request concern error-message clarity.

Content

No source excerpt is available for this finding.

Broad activation keywords can invoke the skill for requests unrelated to improving error messages.

Medium
Category
Trigger Abuse
Confidence
98% confidence
Finding

The trigger list includes broad terms such as support, user feedback, and work-productivity, and line 4 explicitly directs activation when users mention these topics. Neither section requires an error-message improvement context or provides exclusions, allowing unrelated support or productivity requests to activate the skill.

Content

No source excerpt is available for this finding.

Usage keywords include broad terms without limiting activation to error-message improvement.

Low
Category
Trigger Abuse
Confidence
90% confidence
Finding

Keywords such as "support", "user feedback", and "debugging" cover many requests unrelated to improving error messages. Although the example trigger sentences are specific, the keyword list has no explicit scope restriction or exclusions to prevent unintended activation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.